Actually, strictly speaking, neither const nor constref are correct.
The parameter is a pointer to an IID (a REFIID which is an IID by reference) and the C definition does not _explicitly_ say that it is constant, i.e,
HRESULT HIMAGELIST_QueryInterface(
[in] HIMAGELIST himl,
[in] REFIID riid,
[out] void **ppv
);
On the hand, since it is [in] and not [inout] then it is reasonable to presume it is constant (it is as far as the caller is concerned.)
In that case, specifying either "const" or "constref" will produce the same, which is passing the parameter by reference (which is what it should do) and, the call cannot change the IID from the caller's viewpoint since it is passed by value.
Succinctly, specifying either "const" or "constref" will yield the same correct result.
Choosing "const" keeps that definition consistent with already existing definitions.
One thing that would be nice would be to have an overload for the third _out_ parameter. That way, instead of passing the address of a pointer, the call could pass the pointer itself (since out will take its address automatically.) Obviously, that's optional since C doesn't have overloads (at least not standard C that I know of.)